Hi Dear Digos, after few months, i got the answers a lot, your problem is the similar as yours, and i found a ways to solve it at network level without modify client and server-side. From the box we have all what we need (proxy diff at client) and binding the emulator to all interfaces.
My idea was about "if you recieve ddos, automaticly replace player to another live host". But after long testing with hiring some network engeneirs i got simple answer: with tcp it's imposible to do.
BUT!
You can do that with GRE / IPIP Tunnels and advanced routing policy. Ragnarok Online exe support it, and it works well:
Game Host: 50.50.50.50
PlayerIP: 60.60.60.60
GRE1, IP 1.1.1.1
GRE2, IP 2.2.2.2
GRE3, IP 3.3.3.3
60.60.60.60 -> 1.1.1.1 -> 50.50.50.50 with saving 60.60.60.60 -> OK
60.60.60.60 -> 2.2.2.2 -> 50.50.50.50 with saving 60.60.60.60 -> OK
60.60.60.60 -> 3.3.3.3 -> 50.50.50.50 with saving 60.60.60.60 -> OK
So, just google about it. Sorry for stupid answer, but there is nothing to do with rAthena, because this feature is available out the box, and request advanced network education. (it's already work on my projects very fine).
About DDOS Protection:
There is the end of the DDoS attacks at 2015 & 2016. The peak were at 2012 - 2014.
The ddos attacks related to cogent (they sell a very big uplinks for very cheap price, for now they do not sell it anymore after a lot of abuse).
Each online shit which can generate up to 60-70 Gbit/s at 2012 - 2014, and at early 2015 at nowdays can generate maximum 190.000 pps at UDP & 120k pps at TCP. You can avoid it with syncookies + some of the cheap DDoS protected server by hard limiting protocols to your server.
Sorry, this is not bla bla bla from me, i have a projects where i got attacks very big for every week to destroy my project, and i tried a lot of things since 2012...